Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

March 2024

Setting Objectives with ISO 27001's ISMS: A Strategic Overview

ISO 27001 is an international standard specifying how organizations should develop and implement an effective information security management system (ISMS). Organizations can apply ISO 27001 to manage their information security risks and be certified as ISO 27001-compliant. The measures to achieve compliance are specified in Annex A of the standard; organizations should select and apply the necessary controls to safeguard their stakeholders based on their own company risk profile.

Creating an Efficient Document Repository for Compliance

Modern organizations have huge demands for regulatory compliance, which means a huge amount of documentation that your business must generate and manage to show that it is fulfilling those compliance obligations. As such, a document management system is crucial for an effective compliance program. This article will review what document management systems should be able to do, common challenges in building a document management system, and how to get started with doing so.

Third-Party Vendor Risk Management in U.S. Treasury Operations

The U.S. Treasury, also known as the Department of the Treasury, manages the finances of the U.S. government. This department has various duties, including maintaining the economic stability of the United States, managing government finances, and implementing policy decisions that impact both domestic and international affairs. Like most large organizations, the U.S.

TPRM for Government Contractors: General Services Administration Policies

The U.S. General Services Administration (GSA) is an independent agency that helps manage and support the basic functioning of federal agencies. The GSA supplies products and communications, provides transportation and office space, and oversees the government’s real estate portfolio, among other management tasks.

UpGuard Summit March 2024 Recap: Scaling Your TPRM Program

In mid-March, UpGuard welcomed security professionals from APAC, EMEA, India, and the U.S. to participate in the first UpGuard Summit of 2024. This quarter’s event focused on third-party risk management (TPRM), specifically addressing how organizations can scale their TPRM programs to meet their evolving needs and defend their growing attack surfaces.

Vendor Risk Management: Benefits, Process, Software, and Tools

Vendor risk management (VRM) is a process that helps businesses manage the risks associated with their vendors. This includes assessing how well their vendors are performing, identifying potential problems early, and taking appropriate action to mitigate any damage.

Quantifying NIST CSF Maturity Levels for Data-Driven Cyber Programs

Cybersecurity maturity assessments play a fundamental role in helping chief information security officers (CISOs) determine the level of risk their organizations face due to cyber activity. By illuminating the various areas that are exposed to exploitation, these evaluations serve as a blueprint for cybersecurity leaders tasked with making the business secure amid an increasingly risky operational landscape.

Breaches Beyond Borders: The global landscape of third-party risk

While the digital landscape evolves, cyber adversaries are also honing their tactics, techniques, and procedures. In recent years, ransomware groups have made major disruptions to the digital supply chain and, by extension, the world economy. What’s more, organizations in all industries and geographies continue to grapple with third-party threats, zero-day vulnerabilities, and more.

What Does a Solid VM Ticketing Workflow Actually Look Like?

In this webinar, Scott Kuffer discusses the challenges and best practices of vulnerability management workflows and ticketing. He emphasizes the discrepancy between vulnerability management teams' priorities and the priorities of the business as a whole. Scott explores different ticketing workflows, starting with basic vulnerability-based tickets and progressing to more advanced options such as asset-based, team-based, and action-based tickets. He highlights the benefits of automating ticket creation and reporting, as well as the potential for redefining how vulnerability management is approached within organizations.

Understanding the Vital Importance of Security Awareness in Today's Digital World

The IT security awareness training is organized to educate individuals to recognize and avoid cyber threats, aiming to prevent or minimize damage to your company while reducing human errors. By promoting a security-first policy and educating all employees on protecting personal and company data, your company can prevent those threats.

New Research Identifies Oversight Practices Correlated With Effective Cybersecurity Outcomes

In the last few years, boards have rushed to incorporate Cyber Risk into the Board’s overall risk management duty, without really knowing how effective those efforts have been. For the first time ever, Diligent and Bitsight have partnered to see just how well the effort at the board level is translating into reducing Cyber Risk for their company.

Exploring OneTrust Alternatives: Which GRC Fits You Best?

When one looks at the marketplace of governance, risk management, and compliance (GRC) software platforms, it’s clear that OneTrust has established itself as a key player in the field — and also that the quest for the right GRC solution is a nuanced exercise, depending on your organization’s specific needs and preferences.

How to Avoid Online Tax Day Scams: Tips to protect your finances and data

As Tax Day in the U.S. looms on the horizon, so too does the risk of falling victim to online scams. In 1986, the first year that e-filing was available, five people filed their returns electronically. Since then, the popularity of e-filing has increased so much that 92% of individual tax returns are now e-filed. As online tax filing and payment have become more popular, though, scams targeting unsuspecting taxpayers have as well.

Third-Party Risk: How MDR Offers Relief as Security Threats Abound

While third-party products and services are crucial to everyday business operations for almost any company, they also present significant security concerns, as high-profile attacks including SolarWinds and MOVEit laid bare. Trustwave research shows the attacks vary by industry but also makes clear the best defense is the stringent application of the latest security measures, including penetration tests, vulnerability scans, and managed detection and response (MDR) services.

Corporate Cybersecurity Engagement - A Practical Guide for Investors

Bitsight's leading analytics and workflows allow Nomura Asset Management to effectively reduce cyber risk across credit portfolios through targeted engagement. The increasing frequency and complexity of cyber attacks makes one thing clear - cyber risk is inextricably linked to business performance. This has prompted investors to prioritize cyber risk assessments within their portfolios.

Developing a Robust Business Continuity Policy: A Step-by-Step Guide

Business continuity planning is essential for every organization, regardless of size or industry. You need a plan for potential disasters or disruptions to normal business operations. An effective business continuity plan (BCP) details the procedures and resources needed to respond and recover when adverse events happen.

Tackling Patient Data Risks: TPRM for India's Healthcare Sector

India’s healthcare system finds itself at a critical crossroads, struggling to navigate challenges of accessibility, affordability, and quality by pursuing rapid digitization. While this digital transformation provides extensive benefits ranging from greater efficiency to improved quality of care, it also increases the amount of sensitive patient data healthcare organizations store electronically, escalating concerns regarding data privacy and protection.

Why metrics-and context-matter: How CISOs can measure and communicate cyber resilience

Cyberattacks in the digital supply chain are now some of the most common cyber incidents today, with many of the recent major breaches resulting from a single vulnerability. Because of the rapid pace and scale of these attacks, cyber leaders can no longer rely on static analyses of their environments, and must continuously assess cyber risk across their entire supply chain and vendor ecosystem.

5 Steps to Creating an Incident Response Plan

No matter how robust your cyber defenses are, there is a high likelihood that your organization will experience a cybersecurity incident—either directly or as a result of a supply chain attack. Implementing a cybersecurity incident response plan can help you effectively address a cyber event, reduce disruptions to your business operations, and ensure compliance with regulations.

Why is the Exposure Management Market So Confusing? Wading Through the Acronyms

If there's one certainty in life for CISOs it is that when it is time to buy into a new or consolidating security technology niche, they're going to have to eat their fair share of alphabet soup. Tech analysts and marketers do love their acronyms after all. We've got our SIEMs, our SOCS, and our MFAs and MDRs to prove that one out.

Enhancing Vendor Relations: Strategies for Direct Communication

Most businesses depend on their supply chains for success — but as the Covid-19 pandemic painfully demonstrated, few companies have a full grasp of their supply chain risk and know how to manage that risk well. One crucial issue is how you communicate with your vendors; vendor communication is a vital part of the procurement process. In this article we’ll explore several strategies for efficient and effective communication and how you can implement them.

Securing Your Systems: A Deep Dive into SOC 2 Systems Security

Organizations are responsible for safeguarding sensitive data in their possession (including customer data) and maintaining a strong cybersecurity posture. One way to do this is by implementing the SOC 2 standard, developed by the American Institute of Certified Public Accountants (AICPA) as a comprehensive framework to evaluate your internal controls for data security and privacy.

From Brackets to Breaches: Securing Your Network Against March Madness Scams

As March Madness sweeps across the nation, the excitement and frenzy associated with the NCAA Basketball Tournament also ushers in a season ripe for cyber threats. This annual college basketball tournament, beloved by millions, creates a unique environment that cybercriminals exploit to launch sophisticated social engineering attacks.

Harnessing the Power of Artificial Intelligence: A closer look at the European Union's new landmark legislation

Artificial intelligence (AI) has become one of the most transformative forces of our time. From the mundane tasks of everyday life to the complexities of global industries, artificial intelligence continues to permeate every aspect of society, reshaping how we live, work, and interact. The growing importance of AI is not just a trend but a fundamental shift in the way we perceive and leverage technology. This is particularly true in the cybersecurity industry.

Strategies for Living with Undetectable AI Content Proliferation

The relentless march of Artificial Intelligence (AI) has brought us to the precipice of a new era in content creation. AI-powered language models are now capable of generating human-quality text, blurring the lines between machine and human-made content. This proliferation of undetectable AI content presents a unique challenge - how do we navigate a world where information authenticity is increasingly difficult to discern? While some may view undetectable AI content with apprehension, it has the potential to revolutionize various fields.

Critical insights into Australia's supply chain risk landscape

Australian organizations find themselves navigating a minefield of supply chain risks, with a surge in incidents stemming from multi-party breaches. These breaches are often caused by vulnerabilities in cloud or software providers and are emerging as a challenge that demands attention and proactive strategies. From July to December 2023, 483 data breaches were reported to the Australian Information Commissioner (OAIC), up 19% from 407 between January and June of the same year.

Expanding Cyber Risk Management Accountability in the EU With NIS 2

‍ ‍No organization, no matter the industry, is exempt from suffering from a cyber attack. The European Union formally recognized this modern-day reality in late 2022 when it published Directive (EU) 2016/1148, more commonly known as the NIS 2 Directive. As an updated version of the original directive enacted in 2016, this newer, sweeping cybersecurity regulation expanded its original scope to encompass even more business sectors.

Why PCI 4.0 Matters: A Deep Dive into Its Importance

The Payment Card Industry Data Security Standard (PCI DSS) is a crucial security standard for protecting personal data during credit card transactions — and managing PCI compliance is essential for businesses that handle such data. The latest PCI DSS standard, Version 4.0, goes into effect March 2024. Organizations will need to adapt to new requirements and maintain compliance to safeguard sensitive information.

Cross-Mapping and GRC Compliance

As businesses grow, they encounter more regulatory requirements — and soon enough, those requirements can feel like a straitjacket of overlapping obligations. The way to wriggle free from that straitjacket is to develop strong governance, risk, and compliance (GRC) capabilities. One important GRC capability is control mapping: mapping various regulatory requirements to specific controls your business does (or does not yet) have, so that you can see where you need to introduce new controls.

Celebrating Cybersecurity Excellence: Forbes Most Cybersecure Banks, 2024

To recognize best-in-class consumer financial institutions and their Chief Information Security Officers (CISOs), Forbes just released its 2024 list of the top 50 consumer banks with the most robust cybersecurity. Together with Forbes, we are proud to recognize top CISOs and their dedication to safeguarding customer data.

Mastering User Entity Controls: A Guide to Complementary Strategies

Complementary user entity controls (CUECs) are essential to any SOC 2 compliance project report. These controls help to confirm the service provider’s system is secure by outlining responsibilities that the client (that is, the user) must undertake as well. Developing strategies to identify, map, and monitor CUECs is crucial for organizations that rely on Software-as-a-Service (SaaS) providers as part of their vendor management process. You won’t be able to manage privacy risks without them.

How to Automate Triggers Based on Expiration Dates

Organizations must stay on top of compliance deadlines and expiration dates. Failure to meet these deadlines can lead to costly penalties, reputational damage, and legal consequences. Fortunately, automated tools can help streamline compliance processes and assure that important deadlines are never missed. In this blog post, we’ll explore how to automate triggers based on expiration dates and the benefits such automation can bring to your organization.

How Nucleus Security Streamlines Vulnerability Management for Government Agencies

Nucleus Security is proud to announce its recent achievement of Federal Risk and Authorization Management Program (FedRAMP®) authorization at impact level Moderate, making it the go-to choice for government agencies seeking top-tier vulnerability management solutions.

What is a Data Subprocessor? The Data Processing Chain Explained

Modern digital supply chains are complicated. As ever more businesses outsource ever more business functions to focus on their core responsibilities, those chains stretch around the world and involve ever more links. This has significant economic, security, and privacy ramifications. Tracking the movement of personal data across digital supply chains is difficult— but it is decidedly not optional.

Why Human Risk Management is Key to Data Protection

Personal data is constantly being processed and transferred in numerous ways - whether in healthcare applications, store loyalty programmes, during purchases or while browsing online. With such a vast amount of personal data in circulation, the likelihood of errors occurring is heightened. It feels like almost every day we hear a story of another company being breached - with data being stolen by cybercriminals looking to steal an individual's identity, access accounts or commit fraud. Things are also getting easier for cybercriminals, thanks to technology advancements like generative AI assisting with more convincing phishing emails and deepfake content.

Aligning Your TPRM Program with India's E-Commerce Rules

India’s e-commerce industry has surged over the last seven years, increasing its estimated revenue from USD 15.53 Billion in 2017 to USD 63.17 Billion in 2023. This dramatic expansion has shepherded new opportunities for organizations in the e-commerce sector but has also exposed these organizations to increased cybersecurity risks and compliance regulations.
Featured Post

SMEs Invest in Tech Opportunities but Risk Missing Security Safeguards

Across Europe, 100 million people are employed by small and medium-sized enterprises (SMEs). The UK has over five million SMEs, providing three-fifths of employment and £2.4 trillion in turnover. As a vital component in the national economy, SMEs must continue to invest in automation, technology-led innovation, and underpin this with strong security.

Data Subject Access Request (DSAR): The Meaning, Procedures, and Challenges

Privacy is the individual’s right to control the use of their personal data, and DSAR is the mechanism by which individuals can enforce this right. This right to their own information, as used by an organization, is guaranteed by privacy laws like Europe’s General Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA). If your organization collects and uses personal data, especially for European or Californian customers, you should be prepared to respond to DSARs.

Navigating Security Risks and Innovations in the Hospitality Industry

As technology has become available, the hospitality industry has focused on making the most out of innovations such as contactless services and eco-friendly practices. The era of mobile and contactless services has ushered in a new normal for hospitality organizations, offering guests seamless experiences with a simple tap of their smartphones.

Post-SOC 2 Gap Analysis: Next Steps for Full Compliance

Achieving SOC 2 compliance demonstrates to customers that your organization takes data security and privacy seriously. The journey to achieve SOC 2 compliance, however, is not easy. For example, when you perform a preliminary assessment to determine your current state of security, you’re likely to find multiple gaps between that current state and what SOC 2 standards expect you to have. You’ll need to close those gaps to achieve full SOC 2 compliance.

Internet of Risks: Cybersecurity Risk in the Internet of Things

Smart homes, connected cars, and smart watches: these are examples of consumer-focused devices in the Internet of Things (IoT). But the Internet of Things extends beyond consumer use as new technologies are implemented in industrial settings and critical infrastructure. With the continuing development of the Internet of Things come new attack surfaces and cybersecurity risk directly related to the IoT.

What is Compliance in Healthcare: Definition, Regulations, and Solutions

Compliance in healthcare is a critical component to preserving the sanctity of modern society. Compliance in any industry ensures adherence to a minimum set of requirements to ensure quality of service; while undoubtedly important everywhere, it’s more so in healthcare due to its direct impact on human lives. For example, while financial compliance secures the safety of our funds, healthcare compliance ensures the safety of our personal selves.

Forrester Includes SecurityScorecard in Cybersecurity Risk Ratings (CRR) Landscape Report

Recent high-profile data breaches attributed to SolarWinds, Log4j, MOVEit, and more have demonstrated that the world still lacks a standard framework to measure cyber risk. Cybercriminals continue to exploit the trusted relationships between companies and their third-party suppliers and vendors, resulting in damaging attacks.

Vendor Risk Assessments: Ultimate Guide

A vendor risk assessment is a critical element of performing due diligence, helping you vet potential vendors effectively and efficiently during the procurement process and throughout the vendor lifecycle. A thorough risk assessment should help you identify, mitigate, and manage the risks associated with your vendors to ensure you remain compliant, maintain a strong security posture, and avoid a costly third-party data breach.

What is a SOC in cyber security? Definition & Meaning

You may have heard people talking about SOC recently, especially now with the increase in the use of digital assets and remote applications. In these cases, SOC enables organisations to bolster their security posture and be more proactive in detecting and preventing threats. But what is SOC in cyber security?

Unveiling CPS 234 Challenges: Insights from APRA's Cyber Security Stocktake

Australia has seen several high profile cyber incidents in 2023 and has seen significant loss of customer data (Canva’s 139 million customers, Latitude’s 7.9 million customers HWL Ebsworth’s 65 government agencies, 2.5 million documents). According to the OAIC Notifiable Data Breaches Report: January to June 2023, the top 3 sectors in that period to report data breaches are Health Service Providers (65 notifications), Finance incl.

Best Industry Practices for Maintaining SOC 2 Compliance

As data breaches and cyberattacks become more widespread, most businesses are making information security and data privacy a top priority. That means they want to know whether your business can be trusted with their sensitive information. SOC 2 compliance is one of the most effective methods to instill that confidence.

Including Digital Risk Protection in Your Threat Detection and Response Strategy

Many organizations focus on addressing the risks within their internal attack surface while overlooking the potential threats created by their external digital footprint on the surface, deep and dark web. This article outlines how companies can significantly mitigate this risk by combining digital risk protection with their detection and response approach.

U.S. Veteran Data Security: Third-Party Risk Management at the VA

The United States Department of Veterans Affairs (VA) is a federal agency that provides comprehensive healthcare services, benefits, and support to military veterans and their families. The VA operates a nationwide system of hospitals, clinics, and benefits offices focused on ensuring the health, welfare, and dignity of those who served in the United States armed forces.

TSSR: Protecting Australian Telecos Against Cyber Threats

The telecommunications sector provides critical infrastructure for many countries, enabling the exchange of information across various industries. Due to the widespread use of digital information in telecommunications, the sector has become a prime target for cyber threats from hackers, state actors, and cyber criminals. In 2023, telecommunications experienced higher credential stuffing rates than other sections, according to F5.

Making Sense of the SEC's New Rules for Cybersecurity Risk and Disclosure (Part II)

Earlier this week, we debuted our mini-series on the SEC’s new cybersecurity rules. In case you missed it — and, understandably, don’t have the bandwidth to backtrack — Part I explored how the (seemingly perpetual) explosion in data creation, data value, and IT complexity since the dawn of the digital age has come to shape our society. In particular, we note why these trends are responsible for our current IT predicament, namely, the rise in threats, risks, and regulations.

Defender for Endpoint: Transforming Endpoint Security with Advanced Threat Protection

In an era where cyber threats are becoming increasingly sophisticated and pervasive, securing endpoints is paramount. Microsoft Defender for Endpoint emerges as a key player in the cybersecurity arena, offering comprehensive protection against a wide array of threats. This blog post delves into how Defender for Endpoint is revolutionizing endpoint security through the use of advanced threat protection technologies.

What is Sentinel? Harnessing the Power of Cloud-Native SIEM for Modern Cybersecurity Challenges

In the rapidly evolving landscape of cybersecurity, staying ahead of threats requires not just vigilance but advanced technology. Sentinel, Microsoft’s cloud-native Security Information and Event Management (SIEM) solution, represents a leap forward in the way organizations detect, investigate, and respond to cyber threats.

SMB Port Numbers: A Guide to Optimizing and Securing Your Network

In the digital age, where data is the new gold, ensuring the security and efficiency of network communication is paramount for businesses of all sizes. The Server Message Block (SMB) protocol plays a crucial role in facilitating file sharing, network browsing, and printer access among devices on a network. Understanding SMB port numbers is essential for IT professionals looking to optimize and secure their networks.

The Role of Self-Attestation in Compliance: Benefits and Challenges

Self-attestations are an increasingly popular tool for cybersecurity compliance frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Cybersecurity and Infrastructure Security Agency (CISA) directives. The idea is that organizations attest to meeting specific security controls and requirements without third-party validation.

Apache Superset - Database Data Retrieval Through Improper Error Handling

Anastasios Stasinopoulos from OBRELA LABS Team discovered a security flaw that affects Apache Superset (before 3.0.4, from 3.1.0 before 3.1.1), an open-source modern data exploration and visualization platform. Apache Superset error handling can be manipulated in order to allow data retrieval from the backend database.

New Malware Attributed to Russian Hacking Group APT28

Late last year, the Computer Emergency Response Team of Ukraine (CERT-UA) released an advisory that reported cyberattacks targeting Ukrainian state organizations attributed to the Kremlin-backed nation-state group APT28, aka Fancy Bear/Sofacy. The advisory listed the use of a new backdoor named “OCEANMAP,” detailed in this whitepaper.

Scaling Third-Party Risk Management Despite the Odds

Despite best efforts to accommodate third-party risk management (TPRM) processes that correspond with increased use of third-party vendors, incident outcomes seem to grow as well. The 2023 global average cost of a data breach was USD $4.45M, a 2.3% year over year increase. In the United States, the average cost of a breach is higher at USD $9.48M.

The Top GRC Software of 2024: Expert Reviews & Comparisons

In today’s complex cybersecurity environment, the need for robust governance, risk management, and compliance (GRC) strategies has never been higher. With evolving regulations, heightened security threats, and complex compliance requirements, organizations are turning to GRC software so that they can meet their objectives efficiently and effectively. That said, your choices for GRC software are many.

Clarifying Roles and Responsibilities in GRC Management

Governance, risk management, and compliance (GRC) are crucial activities for any modern organization. Implementing an effective GRC program, however, is easier said than done. The first and most critical step: defining clear roles and responsibilities so people know what they’re supposed to do to further your GRC A well-structured GRC team facilitates collaboration across departments, leverages cross-functional expertise, and drives consistency in managing governance, risk, and compliance.

Cyber's "Shift Up" Moment

‍ Today, cybersecurity is evolving into cyber risk management. The last few decades of immense technological and digital transformations have meant that, to a large extent, a business’s ability to be resilient is dependent on a reliable, free flow of data and on technology functioning without interruption. This shift has profound implications for the global economy’s ability to remain stable. ‍

Proactive Strategies to Prevent Ransomware Attacks

In today’s digital age, ransomware attacks have emerged as one of the most formidable threats to organizations worldwide. These malicious software attacks encrypt files on a device, rendering them inaccessible to users, and demand a ransom for decryption keys. The impact of ransomware can be devastating, leading to significant financial losses, operational downtime, and reputational damage.

Optimizing Compliance Management With the Best GRC Software

To optimize compliance management within an organization, it’s crucial to select the right governance, risk, and compliance (GRC) software for your business. This guide will review the importance of GRC software, how it helps with compliance management, what essential features to look for, and which GRC solutions are top-rated for 2024, with a special focus on ZenGRC as a leading option. GRC software plays a pivotal role helping businesses navigate the modern risk management landscape.

TPRM & Remote Learning: Defending the Education Sector

The rise of remote learning has motivated cybercriminals to advance their assault on the education sector. In 2022, cybercriminals deployed more than 2200 attacks against higher education institutions every week, a 44% increase compared to 2021 (Check Point, 2022). Risk professionals attribute this increase to various factors, including the structure of remote learning environments.

University Vendor Management: Advanced Risk Assessment Techniques

Like most high-performing organizations, higher education institutions often utilize third-party vendors to outsource key services, such as data management and research initiatives. This reliance on third-party vendors can lead to various risks, including data privacy vulnerabilities, compliance issues, and operational disruptions. Therefore, universities must implement advanced vendor management processes to mitigate these risks.